- Pull in upstream fix for too strict command option parsing

upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands.
Fix build
2025-10-29 16:36:56 +01:00 · 2025-05-21 00:11:41 +02:00 · 2025-05-13 11:00:35 +02:00 · 2025-05-13 11:00:32 +02:00 · 2025-04-29 13:18:44 +02:00 · 2025-04-25 17:38:32 +02:00
3 changed files with 288 additions and 44 deletions
--- a/iptables-1.8.11-command-options-fix.patch
+++ b/iptables-1.8.11-command-options-fix.patch
@ -0,0 +1,27 @@
+commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Wed Apr 23 12:36:13 2025 +0200
+
+    xshared: Accept an option if any given command allows it
+    
+    Fixed commit made option checking overly strict: Some commands may be
+    commbined (foremost --list and --zero), reject a given option only if it
+    is not allowed by any of the given commands.
+    
+    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
+    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index cdfd11ab..fc61e0fd 100644
+--- a/iptables/xshared.c
+++ b/iptables/xshared.c
+@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
+ 	 */
+ 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
+ 		if ((options & optval) &&
+-		    (options_v_commands[i] & command) != command)
+		    !(options_v_commands[i] & command))
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Illegal option `%s' with this command",
+ 				      ops->option_name(optval));
--- a/iptables-1.8.11-fix-interface-comparisons.patch
+++ b/iptables-1.8.11-fix-interface-comparisons.patch
@ -0,0 +1,172 @@
+From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Mon, 18 Nov 2024 13:56:50 +0000
+Subject: nft: fix interface comparisons in `-C` commands
+
+Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
+kernel") removed code which explicitly set interface masks to all ones.  The
+result of this is that they are zero.  However, they are used to mask interfaces
+in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
+comparisons are always true, and check commands which ought to fail succeed:
+
+  # iptables -N test
+  # iptables -A test -i lo \! -o lo -j REJECT
+  # iptables -v -L test
+  Chain test (0 references)
+   pkts bytes target     prot opt in     out     source               destination
+      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
+  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
+  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
+
+Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
+
+Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/nft-arp.c                                 | 10 ++----
+ iptables/nft-ipv4.c                                |  4 +--
+ iptables/nft-ipv6.c                                |  6 +---
+ iptables/nft-shared.c                              | 36 +++++-----------------
+ iptables/nft-shared.h                              |  6 +---
+ .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
+ 6 files changed, 22 insertions(+), 49 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 264864c3..c11d64c3 100644
+--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
+@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
+ 		return false;
+ 	}
+ 
+-	return is_same_interfaces(a->arp.iniface,
+-				  a->arp.outiface,
+-				  (unsigned char *)a->arp.iniface_mask,
+-				  (unsigned char *)a->arp.outiface_mask,
+-				  b->arp.iniface,
+-				  b->arp.outiface,
+-				  (unsigned char *)b->arp.iniface_mask,
+-				  (unsigned char *)b->arp.outiface_mask);
+	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
+				  b->arp.iniface, b->arp.outiface);
+ }
+ 
+ static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 74092875..0c8bd291 100644
+--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
+@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
+-				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
+-				  b->fw.ip.iniface, b->fw.ip.outiface,
+-				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
+				  b->fw.ip.iniface, b->fw.ip.outiface);
+ }
+ 
+ static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index b184f8af..4dbb2af2 100644
+--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
+@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
+-				  a->fw6.ipv6.iniface_mask,
+-				  a->fw6.ipv6.outiface_mask,
+-				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
+-				  b->fw6.ipv6.iniface_mask,
+-				  b->fw6.ipv6.outiface_mask);
+				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
+ }
+ 
+ static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6775578b..2c29e68f 100644
+--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
+@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
+ }
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask)
+			const char *b_iniface, const char *b_outiface)
+ {
+-	int i;
+-
+-	for (i = 0; i < IFNAMSIZ; i++) {
+-		if (a_iniface_mask[i] != b_iniface_mask[i]) {
+-			DEBUGP("different iniface mask %x, %x (%d)\n",
+-			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
+-			return false;
+-		}
+-		if ((a_iniface[i] & a_iniface_mask[i])
+-		    != (b_iniface[i] & b_iniface_mask[i])) {
+-			DEBUGP("different iniface\n");
+-			return false;
+-		}
+-		if (a_outiface_mask[i] != b_outiface_mask[i]) {
+-			DEBUGP("different outiface mask\n");
+-			return false;
+-		}
+-		if ((a_outiface[i] & a_outiface_mask[i])
+-		    != (b_outiface[i] & b_outiface_mask[i])) {
+-			DEBUGP("different outiface\n");
+-			return false;
+-		}
+	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
+		DEBUGP("different iniface\n");
+		return false;
+	}
+	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
+		DEBUGP("different outiface\n");
+		return false;
+ 	}
+-
+ 	return true;
+ }
+ 
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 51d1e460..b57aee1f 100644
+--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
+@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
+ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask);
+			const char *b_iniface, const char *b_outiface);
+ 
+ void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+new file mode 100755
+index 00000000..278cd648
+--- /dev/null
+++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+@@ -0,0 +1,9 @@
+#!/bin/bash
+
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+
+$XT_MULTI iptables -N test
+$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
+$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
+
+exit 0
+-- 
+cgit v1.2.3
+
--- a/iptables.spec
+++ b/iptables.spec
@ -11,7 +11,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
 Version: 1.8.11
-Release: 4%{?dist}
+Release: 9%{?dist}
 Source0: %{url}/files/%{name}-%{version}.tar.xz
 source1: %{url}/files/%{name}-%{version}.tar.xz.sig
 Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
@ -22,6 +22,13 @@ Source6: sysconfig_iptables
 Source7: sysconfig_ip6tables
 Source8: arptables-nft-helper

+# Patch to fix -C handling, already upstream
+# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
+Patch1: iptables-1.8.11-fix-interface-comparisons.patch
+# Patch to fix overly strict command option checking
+# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
+Patch2: iptables-1.8.11-command-options-fix.patch
+
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
 License: GPL-2.0-only AND Artistic-2.0 AND ISC
@ -57,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities
 Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Conflicts: setup < 2.10.4-1
+Conflicts: alternatives < 1.32-1
 Requires(post): /usr/sbin/update-alternatives
 Requires(postun): /usr/sbin/update-alternatives
 %if 0%{?rhel} < 9
@ -236,29 +244,32 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8
 # fix absolute symlink
 ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml

-%if "%{_sbindir}" == "%{_bindir}"
-# We keep those symlinks in /usr/sbin for compatibility
-mkdir -p %{buildroot}/usr/sbin
-mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/
-%endif
-
 %ldconfig_scriptlets

 %post legacy
-pfx=/usr/sbin/iptables
-pfx6=/usr/sbin/ip6tables
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif

 %postun legacy
 if [ $1 -eq 0 ]; then
 	update-alternatives --remove \
-		iptables /usr/sbin/iptables-legacy
+		iptables %{_sbindir}/iptables-legacy
 fi

 # iptables-1.8.0-1 introduced the use of alternatives
@ -271,19 +282,28 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \
 cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup

 %triggerpostun legacy -- iptables > 1.8.0
-pfx=/usr/sbin/iptables
-pfx6=/usr/sbin/ip6tables
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
 alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
 rm /var/tmp/alternatives.iptables.current
 mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables

+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
 %post services
 %systemd_post iptables.service ip6tables.service

@ -297,17 +317,17 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
 %post -e nft
 [[ %%{_excludedocs} == 1 ]] || do_man=true

-pfx=/usr/sbin/iptables
-pfx6=/usr/sbin/ip6tables
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-nft 10 \
-	--slave $pfx6 ip6tables $pfx6-nft \
-	--slave $pfx-restore iptables-restore $pfx-nft-restore \
-	--slave $pfx-save iptables-save $pfx-nft-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-nft-save
+	--follower $pfx6 ip6tables $pfx6-nft \
+	--follower $pfx-restore iptables-restore $pfx-nft-restore \
+	--follower $pfx-save iptables-save $pfx-nft-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-nft-save

-pfx=/usr/sbin/ebtables
+pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
 for sfx in "" "-restore" "-save"; do
 	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
@ -319,11 +339,11 @@ if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
 fi
 update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
-	--slave $pfx-save ebtables-save $pfx-nft-save \
-	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
-	${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
+	--follower $pfx-save ebtables-save $pfx-nft-save \
+	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}

-pfx=/usr/sbin/arptables
+pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
 lepfx=%{_libexecdir}/arptables
 for sfx in "" "-restore" "-save"; do
@ -339,17 +359,26 @@ if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
 fi
 update-alternatives --install \
 	$pfx arptables $pfx-nft 10 \
-	--slave $pfx-save arptables-save $pfx-nft-save \
-	--slave $pfx-restore arptables-restore $pfx-nft-restore \
-	${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
-	${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
-	${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
-	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
+	--follower $pfx-save arptables-save $pfx-nft-save \
+	--follower $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
+	--follower $lepfx-helper arptables-helper $lepfx-nft-helper
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif

 %postun nft
 if [ $1 -eq 0 ]; then
 	for cmd in iptables ebtables arptables; do
-		update-alternatives --remove $cmd /usr/sbin/$cmd-nft
+		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
 	done
 fi

@ -361,7 +390,7 @@ fi
 %{_mandir}/man8/xtables-legacy*
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/iptables.xslt
-%ghost /usr/sbin/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}

 %files libs
 %license COPYING
@ -422,14 +451,30 @@ fi
 %{_mandir}/man8/ip{,6}tables{,-restore}-translate*
 %{_mandir}/man8/ebtables-translate*
 %{_mandir}/man8/arptables-translate*
-%ghost /usr/sbin/ip{,6}tables{,-save,-restore}
-%ghost /usr/sbin/{eb,arp}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
 %ghost %{_libexecdir}/arptables-helper
 %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz


 %changelog
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-9
+- Pull in upstream fix for too strict command option parsing
+
+* Wed May 07 2025 Zbigniew Jędrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-8
+- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
+  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
+
+* Tue Apr 29 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-7
+- Revert last release, it breaks alternatives symlinks
+
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-6
+- Keep symlinks managed by alternatives under /usr/bin
+
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-5
+- Add patch to fix -C handling ( fixes rhbz#2360423 )
+
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
Author	SHA1	Message	Date
Paul Wouters	6710c03251	- Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands.	2025-10-29 16:36:56 +01:00
Phil Sutter	50d38a64ef	Fix build This is a leftover from pre-bin/sbin merge, drop it. Fixes: `f0bc5dc9b6` ("Move iptables symlinks to /usr/bin again")	2025-05-21 00:11:41 +02:00
Zbigniew Jędrzejewski-Szmek	8c8f81088a	Use modern option name for "follower" symlinks	2025-05-13 11:00:35 +02:00
Zbigniew Jędrzejewski-Szmek	f0bc5dc9b6	Move iptables symlinks to /usr/bin again This partially reverts commit `cdf3f93581`. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems.	2025-05-13 11:00:32 +02:00
Phil Sutter	cdf3f93581	Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit `9b74fed687`. These changes break systems, see bz#2362648 and bz#2362808 for details.	2025-04-29 13:18:44 +02:00
Zbigniew Jędrzejewski-Szmek	9b74fed687	Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit `43696a4be3`. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected.	2025-04-25 17:38:32 +02:00
Kevin Fenzi	4ff93fe914	Add patch to fix -C handling ( fixes rhbz#2360423 )	2025-04-20 09:23:41 -07:00